Key takeaways
- Binance says its initial investigation pointed to a compromised DevOps engineer's laptop, but it later reported additional breach points, so the cause is not settled.
- TRM Labs says the thieves drained wallets on ten blockchains, most of it within roughly twenty minutes of 20:05 UTC on October 29, 2026, using signatures collected beforehand.
- TRM, Chainalysis and Elliptic point to North Korea's TraderTraitor group, but Binance has named no culprit and the FBI statement reported does not attribute the attack.
- Loss and freeze figures are preliminary and differ by source: Binance says about $3 billion is frozen, while TRM says about $2.7 billion.
Binance, the world’s largest crypto exchange, lost an estimated $6.3 billion on October 29, 2026, the largest crypto theft on record. According to TRM Labs, most of the money left Binance wallets on ten blockchains within roughly twenty minutes, beginning at 20:05 UTC on a Thursday.
Binance’s first explanation was a compromised DevOps engineer’s laptop. Within a day it said that wasn’t the whole story. For anyone who runs infrastructure, the gap between those two statements is the interesting part.
What has Binance said about how the attacker got in?
Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop, which let an attacker reach a service container and submit unauthorized withdrawals. A day later the company said investigators had found additional points of breach. The laptop is a starting point, not a full explanation.
Co-CEO Richard Teng was direct about the limits of the simple version, as BleepingComputer reported:
“The attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.”
Binance also says it has found no evidence that any wallet private key leaked, and it has promised a detailed technical post-mortem once the facts are verified. It hasn’t attributed the attack to any individual or named a threat group. BleepingComputer’s headline ties the theft to the laptop, which goes further than Binance’s own later statements.
The attack chain, as far as it’s known
TRM Labs and Elliptic describe three visible stages: a wallet for the operator funded through small Tornado Cash withdrawals, preparation well ahead of the theft, and signatures collected early, then used all at once in a single burst. Binance hasn’t confirmed this sequence.
Elliptic adds that the attacker rehearsed ahead of time and ran pre-signed transactions. TRM says the pattern matches two earlier North Korea-linked heists: Bybit in February 2025 and KelpDAO in April 2026.
There’s a tension here that nobody has resolved. If the transactions were signed in advance, someone had a way to get valid signatures. Binance says no private key leaked. Both can be true, but how the signatures were obtained is not yet reported, and it’s probably what the “additional breach points” will turn out to be about.
Why did the 20-minute burst work so well?
Speed beat the freezes. Once pre-signed transactions fire across ten chains at once, defenders can only react after the money has moved. Stablecoin issuers froze what they could, but the attacker had already started converting into assets nobody can freeze.
By TRM’s count, freezes by Tether, Circle, Ripple and World Liberty Financial came to about $2.67 billion in stablecoins. Arbitrum’s Security Council also froze 74.6 million ARB and 8,426 ETH, which brings TRM’s total to roughly $2.7 billion. Binance puts the frozen amount at about $3 billion. Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC, and Tether CEO Paolo Ardoino said Tether froze more than $1.5 billion in USDT that may be related.
TRM says the attacker outran the freezes by dumping USDT on market makers, then taking out ETH loans on Aave with USDT as collateral. The attacker’s holdings that no issuer can freeze are 18,270 BTC and upwards of 420,000 ETH, worth around $2.4 billion, according to TRM. Elliptic, as reported by Ars Technica, says about $3.3 billion was converted into unfreezable assets and the attacker is trying to cash out into traditional currency. Those two numbers don’t match, and only one outlet reported Elliptic’s.
How does it compare with Bybit and Binance’s 2019 hack?
It’s roughly four times the size of the Bybit hack of February 2025, about $1.5 billion and the previous record. The Bybit theft hit a cold wallet in the middle of a transfer. Binance says this one ran through a service container submitting withdrawals, which points at the withdrawal pipeline rather than a storage wallet.
Binance’s own history looks small by comparison. In May 2019, hackers took 7,000 bitcoin, about $40.7 million, from its hot wallet and also obtained user API keys and 2FA codes. Binance covered that loss from its emergency fund. This time it says it will cover all losses from its SAFU fund and company funds, and that user funds are safe. It says it has set aside more than $6.34 billion in company money, with $5 billion already sitting in the affected tokens. Buying the rest may be slow because some of those tokens have low liquidity.
Who do analysts say did it?
TRM Labs says with high confidence that the attack was the work of TraderTraitor, a hacking unit backed by the North Korean state. BleepingComputer says TRM’s reporting links it to the names Lazarus Group and APT38. Chainalysis says TraderTraitor appears responsible based on on-chain activity in the hours after the hack, and Elliptic also suspects North Korea.
All three are private blockchain-analysis firms. The FBI said it knows of the incident and is talking with government and industry partners as it sizes up the damage and coordinates investigators. The statement as reported doesn’t name a culprit.
What this means if you run infrastructure
The practical lesson is to stop treating one compromised endpoint as the whole threat model. Teng’s comment reads to me as a warning against the comfortable story where a single bad laptop explains everything. Binance has paused withdrawals while it reworks its withdrawal security and address controls, and says it expects to start resuming them within about 48 hours.
If you operate anything that moves money or secrets, a few checks are worth running now:
- Map what a developer laptop can reach, including service containers that can trigger sensitive actions.
- Keep authorization for a transfer separate from the system that executes it.
- Alert on bursts of activity across several chains or systems at once, and on fresh wallets funded in small amounts through mixers.
- Keep endpoints patched; our note on Apple’s latest iOS security fixes is one example of the routine.
For engineers’ admin logins, a hardware security key such as the YubiKey 5 NFC is a cheap place to start. Binance hasn’t said how the laptop or its sessions were compromised, so I wouldn’t promise it would have stopped this. It does shrink one obvious gap. For a different kind of exposure, see how the DHS data leak got blocked, promoted and pulled.
What nobody has confirmed yet
The biggest gaps are about access, not money. Binance has said more breach points exist but hasn’t described them, and there’s no public explanation of how pre-signed transactions were obtained when it says no key leaked. Whether an insider or social-engineering element was involved is not yet reported.
On the money side, these questions are open:
- Whether the $2.4 billion to $3.3 billion in unfreezable assets can be traced or recovered. CNBC reports Binance says it has begun recovering assets, with no amount given.
- Whether any government will formally attribute the attack to North Korea.
- When withdrawals actually resume, and whether users will face delays or limits.
- What Binance’s updated Proof of Reserves, promised after remediation, will show.
Reports also differ on whether deposits were ever suspended. Some say both deposits and withdrawals were paused at first, while others say only withdrawals were. Every loss and freeze number above is a preliminary estimate and may change as the post-mortem lands.
Tools & products mentioned
- YubiKey 5 NFC on Amazon — Check current price
Disclosure: some links in this article are affiliate links or our editor's own courses and book. If you buy through them, TechyCluster or its editor may earn money at no extra cost to you. This does not influence what we cover or how we cover it. As an Amazon Associate, TechyCluster earns from qualifying purchases.
Frequently asked questions
How did hackers break into Binance?
Binance's initial investigation pointed to a compromised DevOps engineer's laptop that gave an attacker access to a service container. Binance later said it found additional breach points, so the full method is not yet public.
Who hacked Binance?
TRM Labs attributes the attack with high confidence to North Korea's TraderTraitor group. Chainalysis and Elliptic also point to North Korea. Binance has not named a culprit, and the FBI statement reported does not attribute it.
How long did the Binance theft take?
According to TRM Labs, most funds left wallets across ten blockchains within roughly twenty minutes, beginning at 20:05 UTC on October 29, 2026.
When will Binance withdrawals resume?
Binance says it expects to start resuming withdrawals within about 48 hours of its Friday update. It paused them while reworking withdrawal security and address controls.
Get the next one in your inbox. One email a day with the tech stories that matter, explained in plain English. Subscribe free.
Sources
This article was compiled from reporting by the following outlets. Links go to the original reports.
- TechSpot: Binance loses $6.3 billion in largest crypto heist ever
- BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop
- CNBC Top: $6.3 billion Binance hack is largest crypto theft on record
- Ars Technica: Hackers steal $6.3 billion from Binance in record crypto heist
- Engadget: Binance hacked for an estimated $6.3 billion in record crypto theft
